@ship.zone/ci-spec 2.0.0

package/conformance/ci-actions/valid/release-signing.yml

@@ -0,0 +1,71 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+  tag:
+    tags:
+      - v*
+permissions:
+  source: read
+  artifacts: write
+  caches: none
+  images: none
+  npm: none
+  releaseAssets: publish
+jobs:
+  test:
+    runner:
+      profile: oci
+      labels:
+        - linux
+    execution:
+      profile: oci
+      image: registry.example/ci/deno@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    steps:
+      - run:
+          - deno
+          - task
+          - test
+  release:
+    triggers:
+      - tag
+    needs:
+      - test
+    runner:
+      profile: vm
+      labels:
+        - linux
+      platform: linux/amd64
+    execution:
+      profile: vm
+      image: registry.example/ci/live-build@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
+    network:
+      mode: egress
+      allow:
+        - host: deb.debian.org
+    secrets:
+      - name: ECOOS_UPDATE_MANIFEST_PRIVATE_KEY_PEM
+        environment: MANIFEST_PRIVATE_KEY_PEM
+    steps:
+      - name: Build the ISO
+        run:
+          - ./scripts/build-iso.sh
+          - dist
+      - name: Write and sign the update manifest
+        run:
+          - ./scripts/sign-update-manifest.sh
+          - dist/ecoos-update-manifest.json
+    artifacts:
+      - name: release-files
+        path: dist
+        when: success
+        required: true
+        maximumBytes: 4294967296
+        maximumExtractedBytes: 4294967296
+        maximumEntries: 16
+publish:
+  releaseAssets:
+    - artifact:
+        job: release
+        name: release-files

package/conformance/ci-actions/valid/release.yml

@@ -0,0 +1,109 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+  pullRequest:
+    targetBranches:
+      - main
+  tag:
+    tags:
+      - v*
+permissions:
+  source: read
+  artifacts: write
+  caches: read-write
+  images: publish
+  npm: publish
+  releaseAssets: publish
+jobs:
+  image:
+    runner:
+      profile: oci-image
+      labels:
+        - builder
+    network:
+      mode: egress
+      allow:
+        - host: registry.npmjs.org
+    build:
+      context: .
+      dockerfile: Dockerfile
+      platforms:
+        - linux/amd64
+        - linux/arm64
+  candidate-test:
+    needs:
+      - image
+    runner:
+      profile: oci
+      labels:
+        - linux
+      platform: linux/amd64
+    permissions:
+      source: read
+      artifacts: none
+      caches: none
+      images: none
+    execution:
+      profile: oci
+      image:
+        candidate: image
+    steps:
+      - run:
+          - /tsdocker_test.sh
+  pack:
+    runner:
+      profile: oci
+      labels:
+        - linux
+    execution:
+      profile: oci
+      image: registry.example/ci/node@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    network:
+      mode: egress
+      allow:
+        - host: registry.npmjs.org
+    steps:
+      - run:
+          - pnpm
+          - install
+          - --frozen-lockfile
+      - run:
+          - pnpm
+          - test
+      - run:
+          - pnpm
+          - pack
+          - --pack-destination
+          - .nogit/package
+    artifacts:
+      - name: package
+        path: .nogit/package
+        when: success
+        required: true
+        maximumBytes: 104857600
+        maximumExtractedBytes: 104857600
+        maximumEntries: 1
+publish:
+  images:
+    - candidate: image
+      destinations:
+        - registry: code.foss.global
+          repository: example/app
+          aliases:
+            - kind: version
+            - kind: literal
+              value: latest
+  npm:
+    - artifact:
+        job: pack
+        name: package
+      registries:
+        - https://registry.npmjs.org
+      access: public
+      distTag: latest
+  releaseAssets:
+    - artifact:
+        job: pack
+        name: package

package/conformance/ci-actions/valid/resources.yml

@@ -0,0 +1,79 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+permissions:
+  source: read
+  artifacts: none
+  caches: read-write
+  images: none
+  npm: none
+  releaseAssets: none
+jobs:
+  browser-test:
+    runner:
+      profile: oci
+      labels:
+        - linux
+    execution:
+      profile: oci
+      image: registry.example/ci/node@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    network:
+      mode: egress
+      allow:
+        - host: registry.npmjs.org
+    resources:
+      memoryBytes: 8589934592
+      cpus: 4
+      pids: 4096
+      sharedMemoryBytes: 2147483648
+      workspaceBytes: 21474836480
+      workspaceEntries: 1000000
+    steps:
+      - run:
+          - pnpm
+          - install
+          - --frozen-lockfile
+      - run:
+          - pnpm
+          - test
+    caches:
+      - name: pnpm
+        key: pnpm-store
+        paths:
+          - .pnpm-store
+        access: read-write
+        maximumBytes: 1073741824
+        maximumExtractedBytes: 4294967296
+        maximumEntries: 100000
+  cross-arm64:
+    runner:
+      profile: oci
+      labels:
+        - linux
+      platform: linux/amd64
+    execution:
+      profile: oci
+      image: registry.example/ci/rust@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
+    network:
+      mode: egress
+      allow:
+        - host: index.crates.io
+        - host: static.crates.io
+    steps:
+      - run:
+          - cargo
+          - build
+          - --release
+          - --target
+          - aarch64-unknown-linux-musl
+    caches:
+      - name: cargo-target
+        key: cargo-target-aarch64-unknown-linux-musl
+        paths:
+          - target
+        access: read-write
+        maximumBytes: 8589934592
+        maximumExtractedBytes: 34359738368
+        maximumEntries: 1000000

package/conformance/ci-actions/valid/vm.yml

@@ -0,0 +1,77 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+  pullRequest:
+    targetBranches:
+      - main
+permissions:
+  source: read
+  artifacts: write
+  caches: none
+  images: none
+  npm: none
+  releaseAssets: none
+jobs:
+  docker-test:
+    runner:
+      profile: vm
+      labels:
+        - linux
+      platform: linux/amd64
+    execution:
+      profile: vm
+      image: registry.example/ci/node-dind@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+      workingDirectory: /workspace
+    network:
+      mode: egress
+      allow:
+        - host: registry.npmjs.org
+        - host: registry-1.docker.io
+        - host: auth.docker.io
+        - host: production.cloudflare.docker.com
+    resources:
+      memoryBytes: 8589934592
+      cpus: 4
+      pids: 8192
+      sharedMemoryBytes: 1073741824
+    steps:
+      - run:
+          - pnpm
+          - install
+          - --frozen-lockfile
+      - name: Test with a container engine
+        run:
+          - /usr/local/bin/with-dockerd
+          - pnpm
+          - test
+  macos-build:
+    runner:
+      profile: vm
+      labels:
+        - macos
+      platform: darwin/arm64
+    execution:
+      profile: vm
+      image: registry.example/ci/macos-xcode@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+    network:
+      mode: egress
+      allow:
+        - host: index.crates.io
+        - host: static.crates.io
+    steps:
+      - run:
+          - cargo
+          - build
+          - --release
+          - --target
+          - aarch64-apple-darwin
+    artifacts:
+      - name: binary
+        path: target/aarch64-apple-darwin/release/app
+        when: success
+        required: true
+        maximumBytes: 104857600
+        maximumExtractedBytes: 104857600
+        maximumEntries: 1